- Patch #759844 by jpmckinney, dixon_, plach, ksenzee, fabsor, pillarsdotnet: overlay does not work with prefixed URL paths.

- Patch #859602 by catch, bfroehle: #cache does not record the #attached declared in child elements.

#826486 by kscheirer, drunken monkey, tstoeckler, jhodgdon, sun: Fixed format_date() does not respect admin-defined date formats

#208611 by effulgentsia, ksenzee, p.brouwers, et al: Fixed drupal_add_js() includes settings twice and breaks certain JS files.

#895140 follow-up by David_Rothstein: Tests to ensure older versions of modules are not chosen over new ones.

- Patch #927406 by Damien Tournoud, carlos8f, george@dynapres.nl, amateescu, Volx: colorable themes fail when CSS aggregation is enabled due to improper stream wrapper usage.

- Patch #769226 by Owen Barton, sun, effulgentsia, alanburke, bleen18, mfer: optimize JS/CSS aggregation for front-end performance and DX.

#614082 by dww, c960657: Fixed SimpleTest error collector tests fail when verbose logging is enabled.

- Patch #328357 by bleen18, sun, skilip, alanburke, jenlampton, manarth, fgm, tstoeckler: allow module .info files to add CSS/JS.

- Patch #559584 by tic2000, sun: filter_xss() and Line break filter break HTML comments. Also added tests.

- Patch #829822 by pwolanin, tstoeckler: check Drupal 7 core for vulnerabilities in SA-CONTRIB-2010-066.

#500866 by boombatower, solotandem: Remove t() from assertion messages in SimpleTest, so translators do not get 1000s of bogus strings.

#715142 by effulgentsia, msmithgu, mr.baileys, Damien Tournoud, sun: Fixed Various URLs escaped twice, since check_url() resp. filter_xss_bad_protocol() calls check_plain().

#444228 follow-up by Tri, ridgerunner, Damien Tournoud, et al: Improve Optimize CSS performance by removing support for Mac IE 5.5 comment hacks, and add tests. (Apologies; some of this went in with a previous commit http://drupal.org/cvs?commit=382522)

#721082 by scor, linclark: Fixed Prevent conflicting namespaces and move hook_rdf_namespaces() invocation into rdf.module.

- Patch #348448 by mfb, c960657, marvil07, cdale, jpmckinney: fixed PHP strict warnings when running tests and for PHP 5.3.

- Patch #384992 by effulgentsia, sun: drupal_html_id() does not work correctly in AJAX context with multiple forms on page.

- Patch #652122 by catch, Berdir, mr.baileys, sun, David_Rothstein: access dashboard permission is useless.

- Patch #353918 by Dave Reid, yched: drupal_write_record() writes empty string instead of empty serialized array.